Provide SSL/TLS support

[sherry-ger]

• Version: 2.3
• Operating System: CentOS 6.5

TCP input can be used as a workaround but it would be nice to have SSL/TLS support for syslog input.

[jordansissel]

I think my preference for solving this is to move syslog support into a codec (or a filter) and move everyone to use the tcp and udp inputs for the network part of syslog.

[jordansissel]

(the impact would be that users wanting tls/ssl could use that feature from the tcp input once we did the syslog codec or filter)

[alesnav]

Hello there!

Do you have any ETA for this enhancement?

It would be nice to have this functionality available to secure the whole log path (source -> logstash -> elasticsearch).

Thanks,
Best regards

[jordansissel]

@alesnav I recommend using the TCP input which has TLS support.

[MorrieAtElastic]

Can we either reconsider enabling SSL/TLS in the syslog plugin, or creating a syslog codec per the above discussion? I have a customer heavily involved in ingesting syslog data and she is finding it increasingly difficult to work out ingestion through the TCP plugin. All of the data in her installation now uses SSL/TLS.

If we're not going to support TLS/SSL for the syslog plugin, I would like to know the appropriate repo in which to request a syslog codec, because none seems to have been created.

[MorrieAtElastic]

@jordansissel please check above action: this problem has now become critical for at least one customer who has to import syslog data from a variety of sources and formats. all of which are encrypted using SSL//TLS. Can we at least make a decision as to how we want to move forward on this: do we want to retrofit this plugin for SSL/TLS, or can we provide a syslog codec that can be used with other plugins?

[TonyLeeVT]

Unfortunately, there has not much movement on this issue in four years. This is a pretty critical feature needed to send syslog data securely.

[jaimehrubiks]

TCP input does not work for me as it splits the message into multiple messages... I tried to join them with multiline, but it is overcomplicated, and there is also an issue with tcp+multiline (it leaves \n characters that can't be removed with replacements)